crowdsecurity/crowdsec · error

PRI must be up to 3 characters long

Error message

PRI must be up to 3 characters long

What it means

After consuming PRI digits, parsePRI checks the accumulated numeric value. RFC 5424 PRI is a value 0-999 (facility*8 + severity), so a computed value above 999 means more than 3 digits were supplied and the parser rejects the line. This guards against mis-framed or non-syslog input.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:66

	}

	r.position++

	for r.position < r.len {
		c := r.buf[r.position]
		if c == '>' {
			r.position++
			break
		}
		if c < '0' || c > '9' {
			return errors.New("PRI must be a number")
		}
		pri = pri*10 + int(c-'0')
		r.position++
	}

	if pri > 999 {
		return errors.New("PRI must be up to 3 characters long")
	}

	if r.position == r.len && r.buf[r.position-1] != '>' {
		return errors.New("PRI must end with '>'")
	}

	r.PRI = pri
	return nil
}

func (r *RFC5424) parseVersion() error {
	if r.buf[r.position] != '1' {
		return errors.New("version must be 1")
	}
	r.position += 2
	if r.position >= r.len {
		return errors.New("version must be followed by a space")
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the emitting device to send PRI as facility*8+severity (0-999) with at most 3 digits.
2. Verify the line isn't a concatenation of two syslog frames; enforce proper framing (octet counting for TCP per RFC 6587).
3. Log the raw input to confirm the digits between '<' and '>' and correct the sender configuration.

Example fix

// before
parser.Parse([]byte("<1234>1 2024-01-01T00:00:00Z host app 1 - msg"))
// after (PRI = facility*8 + severity, max 999)
parser.Parse([]byte("<165>1 2024-01-01T00:00:00Z host app 1 - msg"))

// Go: PRI must be 1-3 digits and value <= 999
func priInRange(line []byte) bool {
	end := 1
	for end < len(line) && line[end] != '>' {
		end++
	}
	if end > 4 || end >= len(line) {
		return false
	}
	pri, err := strconv.Atoi(string(line[1:end]))
	return err == nil && pri >= 0 && pri <= 999
}

if err := parser.Parse(line); err != nil {
	if strings.Contains(err.Error(), "up to 3 characters") {
		// reject/quarantine the frame; check sender framing
	}
}

When it happens

Trigger: Calling RFC5424.Parse with a PRI of 4+ digits, e.g. "<1234>1 ..." — pri accumulates to 1234 which exceeds 999, error returned before the '>' is even reached.

Common situations: A buggy sender padding PRI with zeros or emitting a wrong field (e.g. a length prefix parsed as PRI), concatenated syslog frames like "<12>3<34>1..." where '3' before '<' would instead hit error 110 — but "<1234>" style overflow comes from senders emitting invalid priorities.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• PRI must start with '<'
• PRI must be a number
• PRI must end with '>'
• version must be 1
• version must be followed by a space

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/ddc6b004063e5e71. Report an issue: GitHub.